Netmaker v1.5.1 Release Notes 🚀
🚀 What’s New
🔁 Traffic Logs (Beta)
Traffic Logs have now moved into Beta.
- Traffic Logs are now enriched with relevant domain tagging, making network activity easier to audit and investigate.
🧰 Improvements & Fixes
- Scalability & Reliability Improvements
Introduced a peer update debouncer that coalesces rapid-fire PublishPeerUpdate calls into a single broadcast — a 500ms resettable debounce window capped by a 3s max-wait deadline ensures back-to-back operations (bulk node updates, gateway changes, host deletions) produce one peer update instead of dozens, drastically reducing CPU and MQTT pressure on the control plane
Pre-warms peer update caches after each debounced broadcast so pull requests from hosts are served instantly from cache instead of triggering expensive on-demand computation
Batched metrics export to netmaker exporter via periodic ticker instead of publishing on every individual MQTT metrics message, reducing continuous CPU pressure from Prometheus scraping
- Database Schema Migration
Added schema migrations for the Users, Groups, Roles, Networks, and Hosts tables.
- Deprecated Legacy ACLs
Legacy ACLs have been fully removed as part of the platform’s transition to the updated access control model.
- Paginated APIs
Introduced pagination support for Users and Hosts APIs.
- DNS
Added native Active Directory support.
- Posture Checks
Nodes can now skip the auto-update check during join, improving join reliability in controlled environments.
- IDP Sync
Improved identity provider sync behavior:
- Synced IDP groups are now denied access by default until explicitly granted.
- Okta-specific settings are now reset when an IDP integration is removed.
- HA Setup
Streamlined high availability (HA) setup and operational workflows.
- Install Script
Added on-demand Monitoring Stack installation support via:
./nm-quick.sh -m
- Monitoring Stack
Updated the monitoring stack to use the official Prometheus and Grafana images.
- HA Gateways
Reset Auto Assigned gw when it is disconnected from the network.
🐞 Known Issues
- IPv6-only machines
Netclients cannot currently auto-upgrade on IPv6-only systems.
- Multi-network join performance
Multi-network netclient joins using an enrollment key still require optimization.
- systemd-resolved DNS limitation
On systems using systemd-resolved in uplink mode, only the first 3 entries in resolv.conf are honored; additional entries are ignored. This may cause DNS resolution issues. Stub mode is recommended.
- Windows Desktop App + mixed gateway modes
When the Windows Desktop App is connected to both:
- a Full Tunnel Gateway, and
- a Split Tunnel Gateway
the gateway monitoring component may disconnect from the Split Tunnel Gateway.
